CDFE cheat sheet

Order of volatility (RFC 3227), most to least volatile: CPU registers and cache, routing table/ARP cache/process table/memory, temporary file systems, disk storage, remote logs and monitoring data, archival media. Collect the most volatile evidence first.

Chain of custody record must capture, per item: description, unique identifier, collector name, date/time of collection, location of collection, transfer history with signatures, and storage conditions. Any gap in the record weakens admissibility.

Hash integrity: compute SHA-256 (or MD5 plus SHA-1 for legacy compatibility) at acquisition, re-verify before analysis and after any transfer. A matching hash supports that the image is an exact copy; it does not prove the original was unaltered before acquisition.

Forensic image formats: raw/dd (bit-for-bit, no metadata, no compression), EnCase E01 (compression, per-block CRCs, case metadata), AFF4 (open, compression, XML-based). Verify acquisition with a second hash or a tool-embedded CRC comparison.

File system timestamps: NTFS MFT stores $STANDARD_INFORMATION (legacy, user-modifiable) and $FILENAME (less easily altered) timestamps; MACB = Modified, Accessed (MFT entry change), Changed ($STANDARD_INFORMATION change), Born/Created. ext4 stores atime, mtime, ctime, crtime with nanosecond precision.

Deleted data recovery: NTFS keeps file content in $MFT resident data or in clusters marked free in $Bitmap; FAT zeroes the first byte of the directory entry name and follows the FAT chain; ext4 uses extent trees and inode link count 0 with block pointers intact until overwritten.

Anti-forensics indicators: timestomping (SI timestamps earlier than FN timestamps), MFT slack anomalies, USN journal gaps, $LogFile inconsistencies, prefetch/amcache entries missing for executed binaries, and event log clearing (Event ID 1102 for Security log, 104 for System log).

Memory forensics: acquire with a tool that preserves page tables (e.g., WinPmem, LiME, AVML); analyze with Volatility 3 plugins (windows.pslist, windows.psscan, windows.netscan, windows.malfind, windows.cmdline). Hibernation files and pagefiles are memory artifacts on disk.

Legal standards: Daubert factors for expert testimony (testability, peer review, error rate, general acceptance); Federal Rules of Evidence 901 (authentication) and 902(14) (self-authenticating certified data copies); GDPR/CCPA constraints on personal data in evidence.

Acquisition decision rule: if the device cannot be powered down without data loss or business impact, perform live acquisition (memory first, then disk); otherwise image the disk with a write blocker and verify hashes.

Timeline analysis: normalize timestamps to UTC, correlate file system MACB times with registry (NTUSER.DAT, SYSTEM, SOFTWARE), event logs (Security.evtx, System.evtx), browser history (SQLite), and $UsnJrnl records to build a super-timeline (e.g., Plaso/log2timeline).

Windows registry evidence: USB device history in SYSTEM\CurrentControlSet\Enum\USBSTOR and setupapi.dev.log; user activity in NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist and RecentDocs; autoruns in Run/RunOnce keys and Services.

Network forensics: PCAP analysis with tshark/Wireshark filters (ip.addr, tcp.port, http.request); flow records (NetFlow/IPFIX) for volumetric analysis; DNS logs for beaconing detection (regular intervals, high entropy subdomains, TXT record abuse).

Mobile forensics: iOS full file system extraction requires jailbreak or checkm8-class exploits; Android logical extraction via ADB backup or content providers, physical via root or chip-off. Key artifacts: iOS knowledgeC.db and Biome, Android /data/data app databases and /sdcard media.

Cloud forensics: obtain provider logs via legal process (subpoena, MLAT); preserve SaaS audit logs (Microsoft 365 Unified Audit Log, Google Workspace Admin audit); note shared responsibility model limits on host-level access.

Malware triage: static analysis (strings, PE headers, imports, entropy for packing, YARA rules), dynamic analysis in sandboxed VM with network simulation; capture memory and process tree before termination.

Report writing: state scope, methodology, tools and versions, findings with evidence references (image name, offset, hash), limitations, and conclusions. Avoid conclusory legal language; distinguish observation from inference.

Hash collision caveat: MD5 and SHA-1 are collision-broken for adversarial input; use SHA-256 or SHA-512 for evidentiary integrity. Keep original hashes for continuity even when re-hashing with stronger algorithms.

Slack space and unallocated space: file slack is the remnant between logical EOF and end of the last cluster; volume slack is unused space after the last cluster; unallocated space is clusters marked free. Carving (PhotoRec, foremost, bulk_extractor) targets file headers/footers in unallocated space.

Windows artifact quick reference: $MFT (file records), $LogFile (transaction journal), $UsnJrnl:$J (change journal), $Secure (ACLs), $Extend$ObjId, $Quota, $Reparse; SRUM (SRUDB.dat) records per-app network and resource usage; Amcache.hve records executed binaries.

Linux artifact quick reference: /var/log/auth.log or /var/log/secure (authentication), /var/log/wtmp and btmp (logins), ~/.bash_history, /etc/passwd and /etc/shadow, systemd journal, /proc for live process state, cron and at jobs.

Browser and email artifacts: Chrome/Edge History SQLite (urls, visits, downloads), Firefox places.sqlite, cookies and Local Storage; Outlook OST/PST and MBOX for email; webmail cache in browser profile.

Steganography and file signature checks: compare file extension to magic bytes (JPEG FF D8 FF, PNG 89 50 4E 47, PDF 25 50 44 46, ZIP 50 4B 03 04); use binwalk for embedded archives and file for type identification.

Incident response alignment: NIST SP 800-61 phases (Preparation; Detection and Analysis; Containment, Eradication, Recovery; Post-Incident Activity). Forensic imaging typically occurs during containment, after volatile data capture.

Encryption and containers: BitLocker recovery keys in AD/Entra ID or Microsoft account; VeraCrypt/TrueCrypt headers in the first 512 bytes; LUKS header magic 'LUKS\xba\xbe'; key escrow and legal compulsion vary by jurisdiction.

Tool validation rule: any tool used for evidentiary purposes must be tested against known data sets (e.g., NIST CFReDS) and its version, configuration, and output documented in the report.

Write blocking: hardware write blockers intercept ATA/NVMe/USB commands; software blockers (e.g., mount read-only, registry write protection) are weaker because they depend on the host OS. Never boot a suspect OS to image it.

Live response order: capture RAM, then network connections and ARP cache, then running processes, logged-on users, open files, scheduled tasks, then disk image. Record commands and outputs with timestamps.

Hashing during acquisition: hash the source and destination in the same session; a mismatch indicates bad sectors, write blocker failure, or media error. Use ddrescue for failing drives to maximize recovered data.

File carving limitations: fragmented files may not be recoverable by header/footer carving; use file system metadata (MFT, inode, FAT) first, then carving. Validate carved files with format parsers.

Super-timeline sources: file system metadata, $UsnJrnl, event logs, registry hives, prefetch, Amcache, SRUM, browser history, antivirus logs, and cloud audit logs. Normalize to UTC and tag source.

Reporting standard: ISO/IEC 27037 (identification, collection, acquisition, preservation) and ISO/IEC 27041 (assurance of investigative methods) provide frameworks for defensible process.

Preservation letters: send to custodians and service providers to prevent spoliation; document the date, recipients, and scope. Failure to preserve can lead to adverse inference in litigation.

Mobile artifact specifics: iOS backups (Manifest.db, Manifest.plist) store app data; Android SQLite databases in /data/data//databases; call logs and SMS in contacts2.db and mmssms.db.

Cloud storage sync artifacts: OneDrive/Dropbox/Google Drive client databases and logs record synced filenames, timestamps, and account identifiers; these can establish exfiltration or possession.

Network evidence: DHCP logs map IP to MAC to hostname; NAT logs map internal IP to external IP and port; proxy logs record URLs and user agents; firewall logs record allowed and denied connections.

Memory analysis artifacts: process list, network connections, loaded DLLs, handles, registry hives in memory, command lines, injected code (malfind), and credentials (lsass dump). Capture before shutdown.

Anti-forensic detection: check for secure deletion tools (SDelete, Eraser), wiping utilities, log clearing, timestomping, and encrypted containers. Absence of expected artifacts can itself be evidence.

Legal hold and privacy: balance investigative need against privacy laws (e.g., GDPR data minimization, employee monitoring notice). Document legal authority for each collection.

Report structure: executive summary, scope and authority, methodology, evidence inventory with hashes, findings by timeline, analysis and interpretation, limitations, appendices with tool outputs.

Quality assurance: peer review of findings, reproducibility of analysis, retention of working copies, and secure storage of evidence with access controls and audit logs.

File system comparison: NTFS (journaling, MFT, ACLs, compression, encryption), FAT32 (no journaling, 4GB file limit, directory entries), exFAT (large files, no journaling), ext4 (journaling, extents, 1EB volume limit), APFS (copy-on-write, snapshots, encryption).

Registry hive locations: SYSTEM, SOFTWARE, SAM, SECURITY, DEFAULT in %SystemRoot%\System32\config; NTUSER.DAT and UsrClass.dat in user profiles. Parse with RegRipper or python-registry.

Event log key IDs: 4624 logon, 4625 failed logon, 4634 logoff, 4648 explicit credential logon, 4672 special privileges, 4688 process creation, 4720 user created, 1102 log cleared.

Prefetch and Amcache: prefetch files (.pf) record execution count and loaded files; Amcache.hve records program installation and execution paths; ShimCache (AppCompatCache) records executables present on the system.

Network capture filters: BPF syntax for tcpdump (host, net, port, portrange); Wireshark display filters (ip.addr==, tcp.flags.syn==1, http.host contains). Save captures in pcapng with timestamps.

Encryption detection: high entropy in file headers, known container signatures (BitLocker -FVE-FS-, LUKS, VeraCrypt), and absence of readable strings. Note that encrypted evidence may require legal compulsion or key recovery.

Incident timeline: correlate initial access, execution, persistence, privilege escalation, credential access, lateral movement, collection, exfiltration, and impact (MITRE ATT&CK tactics) with timestamps.

Evidence storage: maintain temperature and humidity control for physical media, use Faraday bags for mobile devices, and document any change in storage location or condition.

Hashing and integrity: SHA-256 is the current standard; MD5 is acceptable only for legacy compatibility and must be paired with a stronger hash. Store hashes in a signed, timestamped record.

Acquisition types: physical (bit-for-bit, includes deleted and slack space), logical (file system level, excludes deleted data), sparse (allocated data only), and targeted (specific files). Choose based on legal scope and time constraints.

Forensic soundness: the process must be repeatable, documented, and verifiable. Any deviation from standard procedure must be justified and recorded.

Chain of custody form fields: case number, item number, description, serial number, collector, date/time, location, hash value, storage location, transfer signatures, and purpose of transfer.

Tool categories: acquisition (dd, FTK Imager, EnCase), analysis (Autopsy, Sleuth Kit, Volatility), timeline (Plaso, log2timeline), carving (PhotoRec, foremost, bulk_extractor), and reporting (FTK, EnCase, Autopsy).

Legal admissibility: evidence must be relevant, authentic, complete, reliable, and legally obtained. Hearsay exceptions for business records and computer-generated records vary by jurisdiction.

Data recovery limits: overwritten data is generally unrecoverable on modern drives due to TRIM, SMR, and wear leveling; SSD recovery requires chip-off or vendor-specific tools.

Case management: maintain an evidence log, analysis notes, and a final report. Retain working copies and original evidence per retention policy and legal requirements.

Memory acquisition tools: WinPmem (Windows), LiME (Linux), AVML (Linux), Magnet RAM Capture, FTK Imager. Verify the capture with a hash and record the tool version and parameters.

Volatility 3 plugin reference: windows.info, windows.pslist, windows.psscan, windows.dlllist, windows.handles, windows.netscan, windows.netstat, windows.malfind, windows.cmdline, windows.registry.hivelist, windows.hashdump.

Registry analysis: use RegRipper plugins (e.g., userassist, run, services, usb, shimcache) to extract artifacts; document plugin name and version.

Timeline tools: Plaso (log2timeline.py, psort.py) for super-timelines; Timesketch for collaborative analysis; Autopsy for integrated timeline and keyword search.

File carving tools: PhotoRec (signature-based), foremost (configurable signatures), bulk_extractor (feature extraction, not full files), scalpel (configurable). Validate carved output with format-specific parsers.

Network analysis tools: Wireshark/tshark for packet analysis, Zeek for connection logs, NetworkMiner for host and artifact extraction, SiLK for flow analysis.

Mobile tools: Cellebrite UFED, Magnet AXIOM, Oxygen Forensic Detective, and open-source tools (ADB, MVT). Document extraction type (logical, file system, physical) and tool version.

Reporting tools: FTK, EnCase, Autopsy, and manual documentation. Include tool validation results and any limitations encountered.

Incident response phases (NIST SP 800-61): Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity. Forensic imaging typically occurs during containment after volatile data capture.

Volatile data order (RFC 3227): registers/cache, routing table/ARP cache/process table/memory, temporary file systems, disk, remote logs, archival media. Capture in this order.

Chain of custody: document every transfer with signatures, dates, and purpose. Any gap weakens admissibility and may lead to exclusion of evidence.

Hashing: compute SHA-256 at acquisition, re-verify before analysis and after transfer. A matching hash supports integrity but does not prove the original was unaltered before acquisition.

File system timestamps: NTFS MACB (Modified, Accessed, Changed, Born) from $STANDARD_INFORMATION and $FILENAME; ext4 atime, mtime, ctime, crtime with nanosecond precision.

Deleted data recovery: NTFS $MFT resident data or clusters marked free in $Bitmap; FAT zeroes first byte of directory entry; ext4 inode link count 0 with block pointers intact until overwritten.

Anti-forensics: timestomping, log clearing (Event ID 1102), secure deletion, encrypted containers, and USN journal gaps. Absence of expected artifacts can be evidence.

Legal standards: Daubert factors, FRE 901 and 902(14), ISO/IEC 27037 and 27041. Document legal authority for each collection.

Windows artifacts: $MFT, $LogFile, $UsnJrnl:$J, $Secure, $Extend$ObjId, $Quota, $Reparse; SRUM (SRUDB.dat) for per-app network usage; Amcache.hve for executed binaries; prefetch for execution count.

Linux artifacts: /var/log/auth.log or /var/log/secure, /var/log/wtmp and btmp, ~/.bash_history, /etc/passwd and /etc/shadow, systemd journal, /proc for live process state, cron and at jobs.

Browser artifacts: Chrome/Edge History SQLite (urls, visits, downloads), Firefox places.sqlite, cookies and Local Storage; webmail cache in browser profile.

Email artifacts: Outlook OST/PST, MBOX, and webmail cache. Parse with libpff, readpst, or dedicated tools.

Cloud artifacts: Microsoft 365 Unified Audit Log, Google Workspace Admin audit, AWS CloudTrail, Azure Activity Log. Obtain via legal process; note shared responsibility limits.

Mobile artifacts: iOS knowledgeC.db and Biome, Android /data/data app databases and /sdcard media; backups (Manifest.db, Manifest.plist) store app data.

Network artifacts: DHCP logs map IP to MAC to hostname; NAT logs map internal to external IP and port; proxy logs record URLs and user agents; firewall logs record allowed and denied connections.

Steganography and file signatures: compare extension to magic bytes (JPEG FF D8 FF, PNG 89 50 4E 47, PDF 25 50 44 46, ZIP 50 4B 03 04); use binwalk for embedded archives.